Django JWT Authentication behavior different between local & mod_wsgi servers with Django REST framework

Question

I am trying to determine why authentication for protected resources using the Authorization: header behaves properly when using a local development server but not on my deployed apache 2.2 w/mod_wsgi implementation.

I am using django 1.8 with django-rest-framework and the django-rest-framework-jwt lib for JWT based authentication. The apache server is ver 2.2 with mod_wsgi. This is all running on an ubuntu 12.04 instance (python 2.7).

Working case with manage.py runserver on localhost:

# manage.py runserver is running
curl -s -X POST \
  -d '{"username":"[email protected]", "password":}' \ 
  http://localhost:8000/portfolio/login

# Response as expected:
##> {"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp..."}

# Using above token as $TOKEN_STR with JWT prefix for Auth header: 
curl -X GET -H "Content-Type: application/json" \ 
  -H "Authorization: $TOKEN_STR" \
  http://localhost:8000/portfolio 

# Response as expected
##> {"data":"[...]"}

Broken case with apache2.2 mod_wsgi:

curl -s -X POST \
  -d '{"username":"[email protected]", "password":}' \ 
  http://myremote.com/django/portfolio/login

# Response as expected:
##> {"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6Ikp..."}

# Using above token as $TOKEN_STR with JWT prefix for Auth header: 
curl -X GET -H "Content-Type: application/json" \ 
  -H "Authorization: $TOKEN_STR" \
  http://myremote.com/django/portfolio 

# Response behaves as authentication not even there w/403 or 401:
##> {"detail": "Authentication credentials were not provided."}

Apache site config

 #### DJANGO APP ####
    LogLevel info
    WSGIDaemonProcess dev processes=2 threads=15
    WSGIProcessGroup dev

    WSGIScriptAlias /django /webapps/django/config/wsgi.py
    <Directory /webapps/django>
        Order allow,deny
        Allow from all
    </Directory>


    ###  DJANGO APP ####

Possibly relevant configs

config.py

## Django rest frameowkr config
REST_FRAMEWORK = {
    'DEFAULT_PERMISSION_CLASSES': (
        'rest_framework.permissions.IsAuthenticated',
    ),
    'DEFAULT_AUTHENTICATION_CLASSES': (
        'rest_framework.authentication.SessionAuthentication',
        'rest_framework.authentication.BasicAuthentication',
        'rest_framework_jwt.authentication.JSONWebTokenAuthentication',

    )
}

JWT_AUTH = {
    'JWT_ENCODE_HANDLER':
        'rest_framework_jwt.utils.jwt_encode_handler',
    'JWT_DECODE_HANDLER':
        'rest_framework_jwt.utils.jwt_decode_handler',
    'JWT_PAYLOAD_HANDLER':
        'rest_framework_jwt.utils.jwt_payload_handler',
    'JWT_PAYLOAD_GET_USER_ID_HANDLER':
        'rest_framework_jwt.utils.jwt_get_user_id_from_payload_handler',

    'JWT_RESPONSE_PAYLOAD_HANDLER':
        'rest_framework_jwt.utils.jwt_response_payload_handler',
    'JWT_SECRET_KEY': SECRET_KEY,
    'JWT_ALGORITHM': 'HS256',
    'JWT_AUTH_HEADER_PREFIX': 'JWT',
}

Ghostly

upvoting as after 4 years I encounted same issue but Didn't know it is happening due to Apache . – Hydracid

Answer 1

I have encountered similar problem. I figure out that I was missing below directive in the Apache configuration file

WSGIPassAuthorization On

Worldweary

This was exactly what it was. – Ghostly

Answer 2

The solution is in apache conf file, we need to turn on WSGIPassAuthorization like this:

<VirtualHost *:80>
ServerAlias example.com
ServerName example.com
Alias /static /srv/www/MyProject/MyProject/static
<Directory /srv/www/MyProject/MyProject/static>
    Require all granted
</Directory>
<Directory /srv/www/MyProject/MyProject/>
    <Files wsgi.py>
        Require all granted
    </Files>
</Directory>
WSGIDaemonProcess example python-path=/srv/www/MyProject/MyProject python-home=/srv/envs/venv
WSGIProcessGroup example
WSGIScriptAlias / /srv/www/MyProject/MyProject/wsgi.py
WSGIPassAuthorization On
</VirtualHost>

Educe

Answer 3

. . . .

WSGIPassAuthorization On
<Directory /webapps/django>
    Order allow,deny
    Allow from all
</Directory>

. . . .

This work for me Thank you very much https://gulshan1996.blogspot.com/2021/04/jwt-auth-is-not-working-on-apache-server.html

Bussell